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(54) Method for constructing a VPN having an assured bandwidth 

(57) An IP tunnel 101 is constructed between routers 300A and 300B connected with the INTERNET 100. A 
bandwidth of the IP tunnel 101 is assured by setting-up a reservation resource protokol (RSVP) on the IP tunnel 
101 . Further as a traffic control of the routers 300A, 300 and 300B on the IP tunnel 101, a frequency for sending 
packets, which are processed by an input processor and an output processor inside of the router, is allotted 
based on a ratio of the reserved bandwidth in each IP tunnel, the an algorithm for controlling the traffic is 
simplified. Furthermore each of the routers 300A, 300 and 300B on IP tunnel 101 has a function for scheduling 
a reservation and manages a time period at which a Virtual Private Network (VPN) of a type of the reservation 
resource protokol (RSVP) will be used, then it is possible to reserve the assurance of the bandwidth on a 
designated date and time in future. 
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Specification 

TTILE OF THE INVDmON 

Method for constructirig a VPNf having an assured bandwidth 

FIELD CF THE INVENTIQN' 

This invention rela t es to a fuethod for coastnicting a VPN(Virtuad 
Private Ketwork) on the INTERSET. especiaUy relates to assurance and/or 
reservation of a bandwidth by every host and/or sub-network. 



BAC3OT80UND CF THE INVENTION 

llie WN is a network which constructs logical graqjs on a public 

network such as the INTERNET, wherein the logical groi?3s ar& imitually 



clcaed. 



T^ne puDijc network such as the INm^ is connected bj 
the non-specific masses. Therefore, there Is a security problem that 
it. is not possible to awic a dishonest access by a thiKi party, 
principally it Is not possible that only specif ii:^ users 
telecoounicata each other. 

Iherefcre, recently the YPN technique is watched. According to 
the WH technique, a dedicated line is virtually constructed on the 
DflERNET by considering a countejTJlan of the security of end to end, 
and, the dedicated line is used as a mainstay between LAN and UN 
(Local Area Network). 

Concretely, in the prior art of the VPN, a security is carried out 
by an enciTpticn of data between end and end, an authentication of a 
user and a ccntrol of an access, then a closed group is provided hy 
connecting specific points via the IMTERNET. 

Bif constructing VPN on. the public network, it is possible for only 



specific users to communicates each ether, and it is possible to use 
the ZNTEFNET as a dedicated lii2e. 

Hove^/er, because of its specification, the prior VPN does not 
assure network resources such as a bandwidth. 

Namely, the prior \'Pi^ is different from an original dedicated line 
in that the bandwidth is variable 'py an influence of other traffics and 
that it is difficult to predict its teiecorairunication csharacteristics. 

On the other hand, an RSVP is known. Wherein, the F5SVP is a 
resource resetn/ation protokol which attaches importanc* to a QoS 
(Ciiality of Service; bardwidth, delay, flicker) , 

Concretely, as shewn in Fig. 7, all host terminals 201 in the 

specific LAN 200A and 200B connected with the INTERNET 1 00 and all 
reuters 300A, 300B and 300C between LAN 200A and 200B omst support the 
RSVP in each application as a unit. Xn a mark R Indicates a 

support of RSVP. 

•merefore, by the ffSTT? in each application, the user requests a 
network resource which satisfies a specific service quality for e«ajnple 
a jg)ecific bandwidth to the networic, then the user assures it. 

Namely, in the prior art, the network resource has been reserved 
between and and end in each application as a unit by the RSVP. 

By the way, as shown in Fig. 1 , if the routers 3O0A, 300B and 300C 
only support the RSVP in each application, an application on the RS'/P 
can net be connected with both LAN 200A and 200B, because the 
applicatiCTi is terminated by the routers 30QA and 30OB at both ends. 

In a case of intending to assure the bandwidth of the \'PN by 
combinirjg prior art \'PN with the RSVP, there are following problens (1) 
ar.d ( 2). 

( 1 ) Since the r^etwork resources are assured by RSVP between end and end, 
ail hoses connected to VPN must st^jpoit RSVP. 



(2) In the present utilization of VPN, a management in each best or sab- 
net;work as a ^jnit is reccmnended than each applic:ation. In such case^ 
an asS'jrance of the bandwidth in each application is not proper. 
Wherei n, the sub-newori; is a netwoi^k which is made by further 
dividing a ixst part of the IP address into a network part and host 
part. For example, the LAN 200A or LAN 200B In Figs- 7 and 8 is divided 
into sub-networks. 

It is therefore desirable to provide a method for 
constructing a VPK which assures a bandwidth in each host or in each 
sub-netMork as a unit« 

SIM4ARY OF TOE INDENTION 

According to the present .invention, there is provided a method for 
constructing a VPN having assured, bandwidth which comprises steps of: 

a step of constructing an IP tunnel between routers ccnnected with the 
trJTERNET; 

a step of reserving a bandwidth of said IP tunnel by setting-up a 
reservation resource protokol (RSVP) on said IP tunnel. 

In an embodment of the present invention, further as a traffic 

control of saic roucer on said IP tumel, a fVequsr-cy for sending 
packets, which are processed by an input processor and an aatput 
processor inside of said router, is allotted based on a ratio of the 
reserved bandwidth in each JP tur-nel. 

In another: embodiment, fuarther each of said routers on said IP 
tunnel has a function for scheduling a reservation and manages, based 
on the reservation schedule, a time period at which said reservation 
rescjurce protokol- is used. 
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mSF DESCRIPTIQN GF THE IRAMINCS 

Fig. 1 shows a network model to which the present invention is 
applied. 

Fig. 2 shows a configuration of a traffic coitrol in a router. 

Fig. 3 shows a process of the traffic control In the configuration 
shovai in Fig. 2. 

Fig. H shOTM-s a packet queuing in the traffic control. 

Fig. 5 shows a. process, of a reservation schedule of VPN in the 



Fig. 6 shows a process of a rossrvation schodul© of VPN in th& 
router. 

Fig. 7 shows a oonventicnal RSVP, 

Fig. 8 shows a fault of the conventional RSVP when a host of a LAN 
does not support RSVP. 

Fig, 9(a) shows an embodiment of the present invention. 
Fig. 9(ti} shows an embodiment of the present invention. 

Fig. ) 0 shows an explanation for sis^slifyiiig an algorism of a 
packet scheduling. 



DETAILED DESaaPTIQN OF FPiFERRED EMBCXlIKEjriS 

An embodiment of the present invention will be explained refeiring 
to Figs.gCa), 9(b) and 10, 

In an example shown in Fig. 9(a), an IP (Internet Protokcl) tunnel 
101 is constructed between a router 300A and a router 300B respectively 
conr^ted with the INTERNET. As well-known, the IP tunnel is a section 
where a packet exists, wherein said packet is constrticted by adding or 
enc^ulating, to an original packet, an IF header vhxch has an IP 
address of the router 3CQA and an IP address of the router 3003 (a start 
point ar.d an end poir.r of the IP tunnel 101 ) etc. An router In the end 



point, for example the router 300B, removes the IF header. 

Iherefcre, the IP tunnel 10 1 becomes a '/PN for tha LAN 20CA and 
the LAK 200B by passing, throu^ the IP tunnel 101 , ali traffics between 
the LAN 200A and the LAN 200B which are belonged to the routers 300A 
and 30(B at iDoth era3s. 

Each cf the routers 300A, 300B and 300C on the IP tunnel 101 
supports a RSVP (Reservation Resource Protokol) , then these rotters set 
up th6 RSVP an the IP turaiel 101 . applicatiai 202 an both LAN 

200A and 20(B is encaps'ilatad at the start point of ths IP tunnel, 
becauss a bandwidth is assured at tha IP tunnel 101 (between routers 
300A and 300B) tiy the RSVP. Then, it is possible for the application 
202, as the data adaptive to the RSVP between routers 30QA and 300B, to 

use network resource (for exacipie, a bandwidth) assured on the IP 
tunnel. 

Wherein, as shown in fig. 9(b), a section of the IP tunnel 101 at 
least includes a section wfriere the RSVP assures the bandwidth (for 
exaniple, a section betveen routers 300A and 30QB) . 

Naoely, it is possible to r&serve a bandwidth in every IP tunnel. 
The bandwidth is reserved not by each application but by each host or 
each sub-network in the LAN 200A and 200B. It is not necessary for the 
hcst 201 tc stqpport the iSVP. 

The reser/aticn of the bandwidth is cancelled by sending a message 
of cancellation by the RSv? from the router 300A (or 300B) to others 
300 and 300B (or 300 and 300A) . 

Since the bandwidth in assured on the RSVP, it is not necessary to 
change a paramster cf each node by manual, then a human cost can be 
deleted. Further, it is possible to speedily and flexibly allocate the 
bandwidth accordix;ig tc a short-term denand. Furthennore, it is easy to 
cancel the assured bandwidth. 



As oientioned-aboTO, by coaibining the IP tunnel 101 with the RSVP, 
it is possible to constiruct the VPN which enables to assure ths 
bandwidth in host 201 or sub-network as a unit without receiving the 

influence of another traffic. 

^ the way, while the SS\FP is a protokcl for rsseirving and 
a5tabl3£hing a network resource^ it dose not prescribe a concrete 
mstfaod for controllir4g a QoS (bandwidth, delay, flicker etc. ), 
Therefore, a assuraxice of the QoS in the network is depend on a traffic 
control of the router and/or a switch. A WQ (Wei^t Fair Queuing) is 
a coaplex algoriaD, because it contrQis a bandwidth and a delay by 

determining a priority according to a traffic characteristics of an 
application, vaierem the WQ is known as an algorism for a packet 
•and/or a scheduling* 

In this case^ since only bandwidth as the network resoiurce is 
reserved, it is possible to control the assurance of the bandwidth by a 
siiEple algorism of a packet scheduling as shown in Fig. 1 0 except for 
said complex algorisai of WFQ. Especially, the traffic control of each 
router 30QA, 300 or 300B on the IP turjiel 101 is siinplified by using an 
algorism that a frequency cr a number of packets which are processed by 
an input processor and an output processor inside of said routers 300A, 
300 and 300B, is allotted based on a ratio of the bandwidth reserved in 
each IP tunnel lOU 

In fig. 10, the packet schedule Is carried out by a packet 
scheduler 401 , a buffer 1*02 for plural RSVP (IP tunnel) ih and a 
buffer 403 for non RSVP (a protokol except for RSVP). Namely, since a 
bandwidth between adjacent routers is divided to a bandwidth for each of 

the plural IP tunnels and a bandwidth for others (a bandwidth for non 
IP tunnel), a buffer space in the each router is divided to the buffer 
402 for the plural I? tunnels and the buffer 4Q3 for others (for non IP 



tAjnnel) . It is assumed that a paoket is arrived at each biiffer 402 for 
R3\T with same distribution cf a traffic characteristics. Then, an 
algorism is simplified by allotting a buffer size of each buffer 402 for 
RS^/F and a frequency for packets which are send from each buffer 402 
for RSW by the scheduler 401 based an a ratio of the reserved bandvddth 
in each IP tunnel. Wherein, the buffer 403 for nm RSVP sends out 
a packet In a low priority. For example, the buffer 403 for non RSVP 
sends out a packst when no packet is in the buffer 402 for I?SVP. 

?urthsnaord, in th& re&ervation of the netwoxic resources hy usiJig 
the original RSVP, the netHCxHc resouro^ are resdrvsd only vmsn the 

resources are necessary. However, in the present invention, it is 

possible to extend the original RSVP and to desi^n&te a dote or a time 
when the reserved bandwidth will be usad, because each of routers 30QA, 
300 and 30QB the IP tunnel 101 has a function fbr scheduling a 
reservation and manages a time period at which VPN of a type of a 
reservation resource is used. 

An eobodiment of the present inventicai will be explained referring 
to Figs, 1—6. 

In a network model shown in Fig.1 , three LANs 20QA, 20QB and 2C0C 
are connected with the II^IER^ET \da routers 30GA, 300B and 300C which 
support RSVP. A router 300 on the LNTIERNET also supports BSVP. An IP 
tunnel tOI is set betvjeen the router 300A and the router 30QB, also an 
IP tunnel is set between the router 300B and the router 30X, and, an IP 
turjtel is set between the router 300C ar^d the router 30QA, Then, all 
traffics between LAN 200A and LAH 20CB are passed through the IP tunnel 
lOi , all traffics between LAN 2003 and LAN 200C are passed through the 
IP tunnel between the router 200B and the router 30X, and, all 
traftlcs between LAN 200C aivi LAN 20OA are passed t±rcu^ the IP tunnel 



between the router 300C and the router 30QA» 

The IP tunnel 101 is set by adding an Ip tunnel function only on a 
machine (IP tunnel server ) at both ends of the IF tunnel 101 . Naniely, 
a router at one end of the IP tunnel (for exanrpie, the router 300A) 
request the setting of the IP tunnel to a router at another end of the 

IP tiTOjel (for example, the router 30QB) , then the IP tunnel is set- 
As aentioned'-above, encaps u l a tion or cancellation of the IP packet 
at a start point or an end point of the IP tunnel is carried cut in a 
range including a section 102 (shown in fig, 9) vdxere a bandwidth is 
assured by RS^/P, Ih&refore, it is possible that the Ip tunnel function 
is added by a provider of a bandwidth (for exaaiple, telecanmunication 
carrier). Further, as shown la Fig. 9(b), it is possible for a user of 
the bandwidth to add the Ip tunnel function on LAIfe 200A and 2Q0B by 
using a IP tunnel server 203- 

Furthermore J in this enlDodiinent, a security is carried out by an 
encryption of data between UK 200A and 2006, between LAN 2005 and 
200C, and, between LAJW 2CMC and 20QA, an authentication of a user and a 
control of an access, then LANs 200A, 20QB and 20X are connected each 
otter via the DrTBRNET, 

The router is constructed as shown in Fig. 1 for controlling the 
traffics. In this eoibodiioent^ each router has two input interfaces and 
two output Interfaces, because usual router has plural input interfaces 
and plural output interfaces. 

In the router, at a process for assuring a bandwidth by RSVP 
before data transmission, the input buffer 301 for RSVP and one input 
buffer 302 for non RSW ( for nai-reserved-type packet) are set in a 
input side, and the output buffer 303 fcr RSVP and the output buffer 
304 for non RSVP are sex. in output side. A nuinber N of the input buffer 
301 is the same number of the IP tunnel (a nunfcer of reser^ration) , A 
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number L+M of the oul^nit buffer 303 is larger than the number of the IP 
tunnel (a nunaber cf reservation). One output buffer 30U is set in each 
output interfac e. Whereir., a sizs of each buffer is variable according 
to the bandwidth reserved to each P tunnel. 

Further, the router comprises an input processor 305, an output 
processor 306 for each, output im:€rfa:»s, an processor 307 for 
idsntiiying a rsser\'ation and a reservation data-base 308 linked to the 
processor 307. In the data base 308, an existence of a bandwidth 
reservation and data i4:ich is necessary to identify, verify and confirm 
each content of a reservation (for axaniple, IP ^nrjro^g cf sending side, 
IP address of receiving side, port nuaber, protokol ID, reserved 
bandwidth, etc.) are stored. In fig- 2, 309 denotes en eriginai packet 
(IF datagram), 310 denotes an IP header in which the IF addz^ss of the 

routers at both ends of the W tunnel and 31 1 denotes a encapsulated 
packet to which the I? header 310 was added. 

"Ihe reservation of the barjdwldth to the IP tunnel is carried 
principally riien a host or a si^netvrork on LAN needs the bandwidth. 
For the reservation, the best or sub-netwciic informs a request for an 
assurance of a banchrfidth to a router at one end of a section where a 
bandwidth is assured by RSW, and, infonns a content (for exanple, IP 
address of sending side, IP address of recer/ing side, port number, 
protdcol ID, reserved bandwidth, etc. ) cf a reservation. Ihe router 
transfers these inforxation to other routers on a way and a router at 
another end of the IP tunnel by RSVP. Each router stores the 
reservaticsi of the bandwidth and its content in the data-base 308. If 
a certain router can not reserve the bandwidth, the router infomB a 

message indicating a rejection of the reqvest to the router at the 
paint. 
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A traffic controi in the router will be e^tpiained referring to Fig 

(1 ) As steps SI ^ S2 shown in rig,3, referring to the data-base 308, 
the processor 307 identifies, verifies and confirtns an existence of a 
bandwidth reservation and each content of a reservation (for exscDple, IP 

address of sending side, IP addr^s of receiving side, port nxtnber, 

protokol ID, reser%^ bandvddth, etc.) to packets arrived at each input 
interfaoe. 

(2) After identification, ■'/erifioaticn axxi oonfirmation of the existence 
of a bandwidth resei^tlon and the content of each reservation, as 

steps S3 sho'^fli in Fig. 3, the processor 307 allocates the packets to the 
input buffer ccrrespondlng to the reserved IP tunnel. 

(3) At a transferring the packets, the input processor 305 obtains a 
packet from the input buffer having a high priority, as rolIaNSd)--^®. 

(I) As show in Fig.^, it is assumed that three buffers #l,^^2,#3 are 
used as the input buffer 301 for RSVP, one input buffer 302 for non- 
fSVP is used and a ratio of each reserved bandwidth of IP tunnel and 
non reserved bar^*^'idth is i:j:k:x, 

(D The Lnp-Jt processor 305 takes out the packet tvm each input 
buffer by accessing each input buffer with a frequency fa accordir^ to 
tiie ratio of the bandwidth. Concretely, the frequency fo is indicated 
by fm=ni/(i+j+k+x}, wherein m is any one of i, j,k and x. If no packet 
exists in ail input buffers ~?^3 for RSVP when the input processor 305 
accesses to these buffers, the input processor 305 accesses to the 
input buffer 302 for non-RSVP. If a packet exists in the input buffer 
302, the input processor 305 takes it out fcnn the buffer 302. 
(43 After processing to the inpjt buffers, th.e input processor trarjsfsrs 
the packet to corresponding output buffer. 

(5) As steps So -^S7 in Fig.3, the output processor 306 oorre^^nding to 
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each output interface tales out the packet froa the output buffer. 
Namely, 

Q) As show in Fig. 4, it is assuioed that three buffers #1 ,#2, #3 are 
used as the output iDuffer 303 for RSVF, one output buffer SOU for non- 
RSVP is used and a ratio of eadi reser/ed bandwidth of IP tunnel and 

non r&s&xved bandwidth is i:j:k:x. 

(D The output processor 306 takes out the packet from each output 
buffer by accessing each output buffer with a firequency fm according to 
the ratio of the bandwidth. Concretaly, tha frequency fm is indicated 
by flnFm/(i+j+k+x), vtoein m is any one of i, j,k and x. If no packet 
exists in all output buffers #1'-#3 for RSVP when the ouQwt processor 
3C6 accesses to these buffers^ the output processor 305 accesses to the 
<»itput buffer 30^* for non-RS'/P. If a packst exists in the output 
buffers the outpur processor 306 takes it out form the buffer 30U. 

Next, a reser/ation schedule function of VPN* will be explained 
referring to Figs.5~6. As aientioned-above, while in the reservation 
of the network resources by using the originad FSVP, the network 
resouortses are reserved only vdien the resources are necessary, in the 
present ecjbodioent, by the following processes (I) '-(V), it is 
possible to designate a date or a tin:s fcdien the reserved bandwidth will 
be used. A step S28 in Fig. 5 is contLnued to a step S29 in Fig. 6. 
(I) As steps S21 and S22 shown in Fig.5, when it occurs to reserve in 
advance a use of the resource reservation-type VPN, it is confirmed 
wiiether a setting of a section for an IP tunnel by RSVP is possible or 
not. If inipossibie, as steps S23 and the reservation in advance is 
rejected. 

CH) If the setting is possible, as steps S23 and S25 shown in Fig.5, 
it is ccnfircsed whettier an assurance of a bandwidth which will be 



; 

/ 

required at future data and tin© is possible or net. If inspossible, as 

steps S26 and S2U, the resen^ation in advarce is rejected, 

(IH) If the assurance is possible, as steps S26 and 327, necessary 

inforoiaticoQ of the reservation (date^ tiaia, bandwidtln to be reserv'ed,. IP 
address of sendir;g side, IP address of receivir-g side, port number, 
protokol ID, etc • ) are registered cn a. data-base for reservation in all 
routers an a section for an I? address, 

(IV) On the designated date and term, as steps S2Q shown in Fig- 5 to 
S31 shown in Flg.6 and as following process ©'^d?* it is started to 
provide the reserved bandwidth. 

® After a monitor during a prsdetamii^ period, as stqps S2S and 
S2^ shown in Fig* 5, if no traffic exists froai a host which reserved the 
baniwidth, the reservation in ad^yance is rejected. 

® As steps S29 and S30 shown in Flg.6, when a bandwidth is 
insufficient by a traffic which is not reserved in advance or not 
scheduled, one of following traffic controls (a) and (b) is carried out 
according to a kind of the ncn-reserved traffic. 

(a) If a protokol of the non-re5en«l traffic is not RSVP, all 
the traffic is rejected, 

(b) If a protokol of the ncn-reserved traffic is RSVP, a message 
for cancellation of its reservation is infonaed to its 'jser^ then the 
resen'ation is rejected, 

(V) After the designated date and lerm, as steps S32 shovn in Fig.6, it 
is finished to provide the reserv'ed bandwidth. 

According to embodiments of the present invention, it is possible 
to obtain a traffic characteristics which is not influenced by other 
traffics and noxe stabilized than cCTiventional VPN, because of constructing 
an IP tunnel between routers connected with the INTERNET and reserving a 
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bandwidth cf said IP tunnel by settixig-up a reservatican resource 
protokoi (RSW) on said IP tunnel. It is not necessaary for each 
application to reserN^e a networtc resource because an assurance of a 
bandwidth by RSVP is carried out by an IP tunnel between routers, then 
it is 7X)t necessary for each host and/or sub-netMOrk to supipcrt SSVP« 
Setting and cancelling the assurance of the bandwidth are easy, because 
the bandwidth is assured by RSVP, Therefore, it is not necessary to 
change a parameter of each node by naanual, then a huc^an cost can be 
deleted^ Further, it is possible to speedily and flexibly allocate the 
bandwidth accordir^ tc a sl»rt-term demand. Furthermore, it is useful 
to transmit a lar^ ajmunt of data in short-teno usage. 

Further according to embodiments of the present invention, an algorism 
for the traffic control is very siirplified, because, as a traffic control 
of said router on said IP tunnel, a frequency for sending packets, which 
are processed by an input .processor and an output processor inside of 
said router, is allotted based on a ratio of the reserved bandwidth in 
each IP tunnel. 

Furthermore, while in the reservaticn of the network resources 
by using the original RSVP, the network resoirces are reserved only 
when the resources are necessary, according to embodiments of the present 

invention, it is possible to reserve the assurance of the bandwidth on 
designated date and time in future, because each of routers on the IP 
tunnel has a function fCr scheduling the reservation and manages a time 
period at which VPN of a type of RSVP will be used. 
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WHAT IS CLAIMED IS: 

1 • A method for constructing a VPN havirjg assured bandwidth 

comprising steps of : 

a st^p of constructing an IP tarmel between routers connected with 
the INIERNET; 

a step of reserving a bandwidth of said I? tiinnel by setting-up si 

reservation resource protdool (RSVP) on said IP tunnel. 

2. The n&thod olaicied in olaim 1 9 whsrfi^in each of said routers on 
said IP tUTinel has a f^iincbion for scheduling a resex^atrion and manages, 
based an the reservation achedule, a time period at which said 
reservation resource protdCDl is used, 

3. The method claimed in claim 1 wherein, as a traffic control of 
said router on said IP tunnel, a frequency for sending packets^ which 
are processed by an input processor and an output processor inside of 
said router, is allotted based on a ratio of the reserved bandwidth in 
each IP tunnel. 

4. The CBthod claimed in claim 2 wherein, as a traffic control of 
said router on said IP tunnel, a treqpsr^y for sending packets, which 

are processed by an input processor and an output processor inside of 
said router, is allotted based on a ratio of the reserved bandwidth In 
each IP tunnel. 

5. A method for constructing a VPN having assiju?ed bandwidth 
substantially as hereinbefore described with reference to the 
acccnpanying drawings. 
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